1. Field of the Invention
The present invention relates to the field of network communications. More specifically, the present invention relates to authorizing individual commands in the Remote Authentication Dial In User Server (RADIUS) protocol.
2. The Background
The Remote Authentication Dial In User Server (RADIUS) protocol is an access control protocol used to provide Authentication, Authorization, and Accounting (AAA) services for various network devices, but especially for Network Access Servers (NASes). Most service providers utilize RADIUS, and it is also used commonly in the Enterprise market.
In RADIUS, when a client initiates a call to a NAS, username and password information is collected. This username and password information is then forwarded to a central AAA server. A single transaction with the server is used to both authenticate and authorize the user. A session may then be initiated. A session is an active connection between two devices. During the rest of the session, the user then may initiate commands, and accounting records may be sent to the AAA server indicating the beginning and end of the client session.
A need exists, however, for individual commands to be authorized by an AAA server. This would allow routers or NASes that are accessed by many different administrators performing different functions to operate more efficiently and securely. The RADIUS protocol does not currently support this type of command authorization. The Terminal Access Controller Access Control System (TACACS+) is an access control protocol that offers command authorization. TACACS+ is based on the Transmission Control Protocol (TCP) and provides for a transmission from the network device receiving the command to the AAA server to request authorization to execute the command. The AAA server then may access a stored profile to determine if the user has authorization to perform the command. Then the AAA server may send a transmission back to the network device via TACACS+ indicating the results of the determination regarding authorization.
This solution, however, has several drawbacks. First, each individual command must be authorized. This involves sending a request to the AAA server and waiting to receive a response each time a network device receives a command from a user, causing additional delays in authorizing commands. Also since TACACS+ is based on TCP, a total of 8 packets must be transmitted back and forth between the network device and the AAA server each time a command is authorized, causing additional network traffic.
Additionally, RADIUS is much more commonly used than TACACS+. Accordingly, a need exists for a way to implement command authorization in the RADIUS protocol.